CVE-2026-44585

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.0

Description The ticket creation endpoint accepts a user-supplied service identifier without enforcing ownership validation. This allows authenticated users to create support tickets referencing services belonging to other accounts by modifying the service ID in the request. While this does not provide direct access to service contents or customer data, referenced service information could become visible to support personnel handling the ticket, potentially causing staff to interact with or review unrelated customer services.

Recommendations Update to version 1.5.0.